swift-sqlite-data
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documents patterns for ingesting user-supplied data into database queries, which is a standard surface for indirect prompt injection.
- Ingestion points: Untrusted user input is ingested via the
searchTextandsearchTokensparameters in the full-text search (FTS5) logic documented inreferences/advanced-queries.md. - Boundary markers: The skill demonstrates the use of type-safe query builders and property wrappers (
@FetchAll,@FetchOne) to scope and delimit queries. - Capability inventory: The skill provides instructions for database writes (
database.write), schema migrations, and remote data synchronization using Apple's CloudKit (SyncEngine). - Sanitization: The provided example for
buildFTS5Queryuses simple string concatenation for building search components; developers must ensure the underlying library handles or they manually escape FTS5 control characters. - [SAFE]: The skill consists entirely of documentation, guidelines, and code snippets for developer use, with no signs of obfuscation, malicious persistence, or credential harvesting.
- [EXTERNAL_DOWNLOADS]: The skill describes synchronization with CloudKit, which is a well-known service and a legitimate part of the library's intended functionality for data persistence and sharing.
Audit Metadata